[AI4DSOC] Alert summary KPI charts by PhilippeOberti · Pull Request #215585 · elastic/kibana

PhilippeOberti · 2025-03-21T22:38:08Z

Summary

This PR adds the KPI charts section to the alert summary page. The 3 charts are similar to the ones in the alerts page, but there are some subtle differences, which lead to one of them being a separate component, while the other 2 I was able to reuse the existing components and just add a property to handle the different logic.

Here are the differences:

in the AI for SOC we do not (currently) have cell actions, so a property was added to the charts to be able to hide the cell actions entirely
the title of the right chart as well as the fact that it does not have a dropdown to select the field to group the alerts by meant that a new component (still using existing child components) was created

The charts react to changes to the KQL bar:

Screen.Recording.2025-03-26.at.3.04.01.PM.mov

Notes

Compared to the mocks (link at the end of the PR description), it was decided to not add the icons to the left of the next for the middle and right chart of the KPI section. These might be added in the future, but there is some complexity related to fetching them (especially for the alert by host) and more thoughts need to be had to make sure we're handling all the possible cases.

How to test

This needs to be ran in Serverless:

yarn es serverless --projectType security
yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

And this to generate data: yarn test:generate:serverless-dev

Use one of these Serverless users:

platform_engineer
endpoint_operations_analyst
endpoint_policy_manager
admin
system_indices_superuser

Notes

You'll need to either have some AI for SOC integrations installed, or more easily you can:

change the alert_summary.tsx line 38 from if (installedPackages.length === 0) { to if (installedPackages.length > 0) { to force the wrapper component to render
update 42 of the same alert_summary.tsx file from return <Wrapper packages={installedPackages} />; to return <Wrapper packages={availablePackages} />; to be able to see some packages

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

Mocks: https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev
Ticket: https://github.com/elastic/security-team/issues/11958

elasticmachine · 2025-03-26T21:32:04Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

christineweng

How do you generate testing data for this? manually pushing alerts?

...urity_solution/public/detections/components/alert_summary/kpis/alerts_progress_bar_panel.tsx

...ty_solution/public/detections/components/alerts_kpis/alerts_by_rule_panel/alerts_by_rule.tsx

PhilippeOberti · 2025-03-28T01:09:45Z

How do you generate testing data for this? manually pushing alerts?

It's actually way simpler, just run yarn test:generate:serverless-dev. Currently when running serverless the Endpoint Security rule is automatically running, so it will generate alerts.
I'll have to figure out another way in a few weeks when this is not the case...

I did update the PR description with the info. Thanks!

elasticmachine · 2025-03-28T05:22:45Z

💚 Build Succeeded

Buildkite Build
Commit: bcf1d2a

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	7108	7112	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	8.9MB	8.9MB	+2.3KB

History

💛 Build #287541 was flaky 4f57742
💔 Build #287518 failed 329b71e

## Summary This PR adds the KPI charts section to the alert summary page. The 3 charts are similar to the ones in the alerts page, but there are some subtle differences, which lead to one of them being a separate component, while the other 2 I was able to reuse the existing components and just add a property to handle the different logic. Here are the differences: - in the AI for SOC we do not (currently) have cell actions, so a property was added to the charts to be able to hide the cell actions entirely - the title of the right chart as well as the fact that it does not have a dropdown to select the field to group the alerts by meant that a new component (still using existing child components) was created ![Screenshot 2025-03-26 at 3 02 33 PM](https://github.com/user-attachments/assets/337b3ab4-29c3-40cd-8710-3f5c04898dd7) The charts react to changes to the KQL bar: https://github.com/user-attachments/assets/ed0e8f14-ba66-46ae-94df-6c8064c7a648 ### Notes Compared to the mocks (link at the end of the PR description), it was decided to not add the icons to the left of the next for the middle and right chart of the KPI section. These might be added in the future, but there is some complexity related to fetching them (especially for the alert by host) and more thoughts need to be had to make sure we're handling all the possible cases. ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Mocks: https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev Ticket: elastic/security-team#11958

## Summary This PR fixes an issue with the logic implemented in [this previous PR](#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956

## Summary This PR adds the KPI charts section to the alert summary page. The 3 charts are similar to the ones in the alerts page, but there are some subtle differences, which lead to one of them being a separate component, while the other 2 I was able to reuse the existing components and just add a property to handle the different logic. Here are the differences: - in the AI for SOC we do not (currently) have cell actions, so a property was added to the charts to be able to hide the cell actions entirely - the title of the right chart as well as the fact that it does not have a dropdown to select the field to group the alerts by meant that a new component (still using existing child components) was created ![Screenshot 2025-03-26 at 3 02 33 PM](https://github.com/user-attachments/assets/337b3ab4-29c3-40cd-8710-3f5c04898dd7) The charts react to changes to the KQL bar: https://github.com/user-attachments/assets/ed0e8f14-ba66-46ae-94df-6c8064c7a648 ### Notes Compared to the mocks (link at the end of the PR description), it was decided to not add the icons to the left of the next for the middle and right chart of the KPI section. These might be added in the future, but there is some complexity related to fetching them (especially for the alert by host) and more thoughts need to be had to make sure we're handling all the possible cases. ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Mocks: https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev Ticket: elastic/security-team#11958 (cherry picked from commit 5b7d5ab)

## Summary This PR fixes an issue with the logic implemented in [this previous PR](elastic#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](elastic#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956 (cherry picked from commit 2ed4266)

## Summary This PR adds the KPI charts section to the alert summary page. The 3 charts are similar to the ones in the alerts page, but there are some subtle differences, which lead to one of them being a separate component, while the other 2 I was able to reuse the existing components and just add a property to handle the different logic. Here are the differences: - in the AI for SOC we do not (currently) have cell actions, so a property was added to the charts to be able to hide the cell actions entirely - the title of the right chart as well as the fact that it does not have a dropdown to select the field to group the alerts by meant that a new component (still using existing child components) was created ![Screenshot 2025-03-26 at 3 02 33 PM](https://github.com/user-attachments/assets/337b3ab4-29c3-40cd-8710-3f5c04898dd7) The charts react to changes to the KQL bar: https://github.com/user-attachments/assets/ed0e8f14-ba66-46ae-94df-6c8064c7a648 ### Notes Compared to the mocks (link at the end of the PR description), it was decided to not add the icons to the left of the next for the middle and right chart of the KPI section. These might be added in the future, but there is some complexity related to fetching them (especially for the alert by host) and more thoughts need to be had to make sure we're handling all the possible cases. ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Mocks: https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev Ticket: elastic/security-team#11958 (cherry picked from commit 5b7d5ab)

## Summary This PR fixes an issue with the logic implemented in [this previous PR](elastic#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](elastic#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956 (cherry picked from commit 2ed4266)

## Summary This PR adds the KPI charts section to the alert summary page. The 3 charts are similar to the ones in the alerts page, but there are some subtle differences, which lead to one of them being a separate component, while the other 2 I was able to reuse the existing components and just add a property to handle the different logic. Here are the differences: - in the AI for SOC we do not (currently) have cell actions, so a property was added to the charts to be able to hide the cell actions entirely - the title of the right chart as well as the fact that it does not have a dropdown to select the field to group the alerts by meant that a new component (still using existing child components) was created ![Screenshot 2025-03-26 at 3 02 33 PM](https://github.com/user-attachments/assets/337b3ab4-29c3-40cd-8710-3f5c04898dd7) The charts react to changes to the KQL bar: https://github.com/user-attachments/assets/ed0e8f14-ba66-46ae-94df-6c8064c7a648 ### Notes Compared to the mocks (link at the end of the PR description), it was decided to not add the icons to the left of the next for the middle and right chart of the KPI section. These might be added in the future, but there is some complexity related to fetching them (especially for the alert by host) and more thoughts need to be had to make sure we're handling all the possible cases. ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Mocks: https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev Ticket: elastic/security-team#11958 (cherry picked from commit 5b7d5ab)

## Summary This PR fixes an issue with the logic implemented in [this previous PR](elastic#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](elastic#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956 (cherry picked from commit 2ed4266)

…) (#222074) # Backport This will backport the following commits from `main` to `8.19`: - [[AI4DSOC] Alert summary page routing and initialization (#214889)](#214889) - [[AI4DSOC] Alert summary landing page (#215246)](#215246) - [[AI4DSOC] Alert summary dataview (#215265)](#215265) - [[AI4DSOC] Alert summary KQL bar [#215586]](#215586) - [[AI4DSOC] Alert summary KPI charts [#215585]](#215585) - [[AI4DSOR] Alert summary integrations section [#215266]](#215266) - [[AI4DSOC] Fix issue with filtering by integrations [#216574]](#216574) - [[AI4DSOC] Alert summary table setup [#216744]](#216744) - [Alerty summary table flyout setup [#217421]](#217421) - [[AI4DSOC] Alert summary alert actions in table and flyout [#217696]](#217696) - [[AI4DSOC] Alert summary table custom cell renderers [#217124]](#217124) - [[AI4DSOC] Alert summary table and flyout ai assistant [#217744]](#217744) - [[AI4DSOC] Alert summary page performance improvements [#218632]](#218632) - [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC alerts table [#218736]](#218736) - [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table [#218742]](#218742) - [[AI4DSOC] Fix spacing issue on alert summary landing page integration card [#218868]](#218868) - [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined maintenanceWindow capability [#218999]](#218999) - [[AI4DSOC] Fix link to the new integrations page [#219030]](#219030) - [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack discovery page [#219033]](#219033) - [[AI4DSOC] Add cell renderer for datetime fields to the alert summary table [#219126]](#219126) - [[AI4DSOC] Remove Assistant icon from row action in alert summary table [#219141]](#219141) - [[AI4DSOC] Add checkboxes to the alert summary table [#219169]](#219169) - [[Security Solution][AI4DSOC] Fix table not applying alert tags for Attack discovery and Cases pages in AI4DSOC [#219410]](#219410) - [[AI4DSOC] Fix logic that renders the group title when grouping by integrations [#219430]](#219430) - [[AI4DSOC] Alert summary table truncates long values and display the field/value pair in tooltip [#219438]](#219438) - [[Security Solution] Fix alerts table potentially not applying alert assignees [#219460]](#219460) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

PhilippeOberti force-pushed the alerty-summary-kpi-charts branch 4 times, most recently from 8ce2064 to 329b71e Compare March 26, 2025 21:23

PhilippeOberti marked this pull request as ready for review March 26, 2025 21:32

PhilippeOberti requested review from a team as code owners March 26, 2025 21:32

PhilippeOberti changed the title ~~Alerty summary kpi charts~~ Alert summary kpi charts Mar 26, 2025

PhilippeOberti changed the title ~~Alert summary kpi charts~~ [AI4DSOC] Alert summary KPI charts Mar 26, 2025

PhilippeOberti force-pushed the alerty-summary-kpi-charts branch from 329b71e to 4f57742 Compare March 26, 2025 23:47

christineweng reviewed Mar 28, 2025

View reviewed changes

...urity_solution/public/detections/components/alert_summary/kpis/alerts_progress_bar_panel.tsx Outdated Show resolved Hide resolved

...ty_solution/public/detections/components/alerts_kpis/alerts_by_rule_panel/alerts_by_rule.tsx Show resolved Hide resolved

PhilippeOberti added 2 commits March 27, 2025 22:33

[AI4DSOC] Alert summary kpis section

75911fb

PR comments

bcf1d2a

PhilippeOberti force-pushed the alerty-summary-kpi-charts branch from 4f57742 to bcf1d2a Compare March 28, 2025 03:43

christineweng approved these changes Mar 28, 2025

View reviewed changes

PhilippeOberti merged commit 5b7d5ab into elastic:main Mar 28, 2025
9 checks passed

PhilippeOberti deleted the alerty-summary-kpi-charts branch March 28, 2025 22:39

PhilippeOberti mentioned this pull request Apr 1, 2025

[AI4DSOC] Fix issue with filtering by integrations #216574

Merged

1 task

PhilippeOberti mentioned this pull request May 30, 2025

[8.19] [AI4DSOC] Backport of AI4DSOC alert summary related PRs (#214889) #222074

Merged

PhilippeOberti added the v8.19.0 label Jun 4, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[AI4DSOC] Alert summary KPI charts#215585

[AI4DSOC] Alert summary KPI charts#215585
PhilippeOberti merged 2 commits intoelastic:mainfrom
PhilippeOberti:alerty-summary-kpi-charts

PhilippeOberti commented Mar 21, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Mar 26, 2025

Uh oh!

christineweng left a comment

Uh oh!

Uh oh!

Uh oh!

PhilippeOberti commented Mar 28, 2025

Uh oh!

elasticmachine commented Mar 28, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

PhilippeOberti commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Notes

How to test

Notes

Checklist

Uh oh!

elasticmachine commented Mar 26, 2025

Uh oh!

christineweng left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

PhilippeOberti commented Mar 28, 2025

Uh oh!

elasticmachine commented Mar 28, 2025

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

PhilippeOberti commented Mar 21, 2025 •

edited

Loading